Upd ss & add info save costs 4 investigate topic

Author: cwatson-cat

articles/sentinel/investigate-large-datasets.md

@@ -54,7 +54,7 @@ To learn more, see [Search job](../azure-monitor/logs/azure-monitor-archived-log
 
 When you need to do a full investigation on data stored in archived logs, restore a table from the **Search** page in Microsoft Sentinel. Specify a target table and time range for the data you want to restore. Within a few minutes, the log data is restored and available within the Log Analytics workspace. Then you can use the data in high-performance queries that support full KQL
 
-A restored log table is available in a new table that has a *_RST suffix. The restored data is available as long as the underlying source data is available. But you can delete restored tables at any time without deleting the underlying source data.
+A restored log table is available in a new table that has a *_RST suffix. The restored data is available as long as the underlying source data is available. But you can delete restored tables at any time without deleting the underlying source data. To save costs, we recommend you delete the restored table when you no longer need it.
 
 The following image shows the restore option on a saved search.